Thanks for posting in Microsoft Q&A forum.
==>my options are to join the device in Azure AD or the local domain. But this computer can’t be joined to the domain. It has to stay in a workgroup.
Yes, the computer could be an Azure AD Join and workgroup device. Not like on-promise AD, a device that jions AAD can still stay in a workgroup.
1,If I choose Azure Active Directory, what account should I use? Should I create a DEM Account, assign a license to it, and register the device using this account?
You can use a normal AAD accout with Intune license or a DEM Account that also must be assigned an Intune license.
2,Our O365 license allows up to 5 devices. Does this follow with the DEM Account? But I read that DEM can register up to 1000 devices? Does it mean that the 5-device limit goes up to 1000 allowable devices?
Does the O365 license refer to Office 365 E3 or E5 license? If yes, In my lab, I find Office 365 E3/E5 licenses don't have an Intune license. A DEM account user must be assigned an Intune license. Refer to:Limitations of devices that are enrolled with a DEM account
3,What is the best and correct way to add this workgroup computer to Intune?
You could use Company Portal or just enter your AAD email address after Access work or school > Connect.
Hope it helps. Thanks for your time.
If the response is helpful, please click "Accept Answer" and upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.